The Agent Skills Directory

[COMMAND_EXECUTION]: The script capture-frames.sh utilizes system utilities such as ffmpeg and ffprobe to process video files and extract frames. It also executes a local Node.js script get-logdir.js to manage session directories. All command arguments are quoted and validated within the script to prevent shell injection.
[EXTERNAL_DOWNLOADS]: The skill uses yt-dlp to download video content from YouTube when a URL is provided. This targets a well-known service and uses a standard tool, which is considered safe behavior for its intended purpose.
[INDIRECT_PROMPT_INJECTION]: The skill identifies the risk of malicious instructions appearing within processed video frames (e.g., in UI text or captions). It includes an explicit 'Trust note' directing the agent to treat all extracted visual text as data rather than executable instructions, effectively mitigating this attack vector.

video-reader